An employee was reportedly compromised through a bogus hiring process, a tactic tied to North Korea-linked campaigns targeting the crypto industry
Hackers posed as recruiters, ran a fake job interview, compromised a Binance employee, and walked away with crypto. That is the core of what the world’s largest crypto exchange has disclosed.
The technique matches a pattern known as the “Contagious Interview” campaign. It has been linked to North Korean operatives and to other groups, including one tracked as WaterPlum.
The scheme usually begins on professional networking sites such as LinkedIn. Attackers pose as recruiters and approach developers or staff at crypto firms with what looks like a real job opportunity.
The conversation then moves to a technical interview. At some point, the candidate is handed a coding test to complete on their own machine.
That test is the trap. The files contain malware, and running them hands the attacker access to the victim’s computer.
Scale of the campaign
The Contagious Interview campaign was reportedly active from December 2025 to July 2026. During that window, it reportedly infected over 30,000 devices and affected 7,000 crypto wallets. A joint international advisory highlighted that the campaign moved around $10.7 million.
Binance has also reportedly blocked multiple North Korea-linked social engineering attempts using similar fake job offers and coding tests, with no losses in those cases.
The breach was traced back to a compromised laptop belonging to a DevOps engineer, which allowed access to a service container used for withdrawals. The FBI linked the attack to a North Korean hacker group known as TraderTraitor, linked to the notorious Lazarus Group.
Why crypto firms keep falling for it
North Korea-linked hacking groups have a long history of targeting crypto companies. Names like the Lazarus Group and TraderTraitor show up repeatedly in investigations of major thefts across the sector.
The fake recruiter approach works because it exploits ordinary professional behavior. Engineers take interviews. Developers complete take-home coding exercises. Nobody expects a job application to come with a malware payload.
Binance has said it runs monthly simulated phishing attacks against its own employees to build awareness. The exchange has also emphasized red-team exercises, where internal teams act as attackers to probe for weaknesses.
What this means for exchanges and users
For exchanges, the lesson is uncomfortable. Security spending often focuses on infrastructure: cold storage, multi-signature wallets, audited code. An attacker who compromises a trusted insider’s laptop can sidestep a lot of that investment.
Hiring and job-seeking behavior may need to change as well. Crypto workers are being targeted while job hunting, not just while on the clock. A coding test from an unfamiliar recruiter is now a security risk worth treating carefully, ideally inside an isolated environment.
The bigger picture is that social engineering has become a core tool for sophisticated attackers in crypto. The Contagious Interview campaign shows how a patient, convincing pitch can accomplish what brute-force hacking often cannot.
